On the afternoon of Tuesday September 25 our engineering team discovered a security issue affecting almost 50 million accounts Were taking this incredibly seriously and wanted to let everyone know whats happened and the immediate action weve taken to protect peoples security Our investigation is still in its early stages But its clear that attackers exploited a vulnerability in Facebooks code that impacted View As a feature that lets people see what their own profile looks like to someone else This allowed them to steal Facebook access tokens which they could then use to take over peoples accounts Access tokens are the equivalent of digital keys that keep people logged in to Facebook so they dont need to re-enter their password every time they use the app Here is the action we have already taken First weve fixed the vulnerability and informed law enforcement Second we have reset the access tokens of the almost 50 million accounts we know were affected to protect their security Were also taking the precautionary step of resetting access tokens for another 40 million accounts that have been subject to a View As look-up in the last year As a result around 90 million people will now have to log back in to Facebook or any of their apps that use Facebook Login After they have logged back in people will get a notification at the top of their News Feed explaining what happened Third were temporarily turning off the View As feature while we conduct a thorough security review This attack exploited the complex interaction of multiple issues in our code It stemmed from a change we made to our video uploading feature in July 2017 which impacted View As The attackers not only needed to find this vulnerability and use it to get an access token they then had to pivot from that account to others to steal more tokens Since weve only just started our investigation we have yet to determine whether these accounts were misused or any information accessed We also dont know whos behind these attacks or where theyre based Were working hard to better understand these details and we will update this post when we have more information or if the facts change In addition if we find more affected accounts we will immediately reset their access tokens Peoples privacy and security is incredibly important and were sorry this happened Its why weve taken immediate action to secure these accounts and let users know what happened Theres no need for anyone to change their passwords But people who are having trouble logging back into Facebook for example because theyve forgotten their password should visit our Help Center And if anyone wants to take the precautionary action of logging out of Facebook they should visit the Security and Login section in settings It lists the places people are logged into Facebook with a one-click option to log out of them all